Allow list of regions for aws_kms_replica_key

[frugecn]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

When creating a DynamoDB Global Table, a list is provided to define which regions the global table should reside in. If the Table has a Customer Managed Key defined as well, there doesn't appear to be a way to pass the same list to the aws_kms_replica key for creating those resources as well to keep the two resources consistent.

New or Affected Resource(s)

• aws_kms_replica_key

Potential Terraform Configuration

variable "regions" {
    type = list(string)
    
}

resource "aws_dynamodb_table" "example" {
  name             = "example"
  hash_key         = "TestTableHashKey"
  billing_mode     = "PAY_PER_REQUEST"
  stream_enabled   = true
  stream_view_type = "NEW_AND_OLD_IMAGES"

  attribute {
    name = "TestTableHashKey"
    type = "S"
  }

  dynamic "replica" {
    for_each = var.regions
    content {
      region_name = replica.value
      kms_key_arn = aws_kms_replica_key.replica[each.value].arn
    }
  }
}

resource "aws_kms_key" "primary" {
  provider = aws.primary

  description             = "Multi-Region primary key"
  deletion_window_in_days = 30
  multi_region            = true
}

resource "aws_kms_replica_key" "replica" {
  for_each = toset(var.regions)
  description             = "Multi-Region replica key"
  deletion_window_in_days = 30
  primary_key_arn         = aws_kms_key.primary.arn
  replica_regions =  each.value
}

References

• #0000

[ewbankkit]

@frugecn Thanks for raising this issue.
It has already been noticed in #22243. I'm going to close this one as a duplicate so that we can concentrate discussion in the linked issue.
Please add any additional comments there.

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.